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DETAILED ACTION 

1 . Claims 1-23 have been submitted for examination. 

2. Claims 1-23 have been examined and rejected. 

Claim Rejections - 35 USC § 101 

35U.S.C. 101 reads as follows: 

Whoever invents or discovers ar»y new and useful process, machine, manufacture, or composition of 
matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the 
conditions and requirements of this title. 

3. Claims 1-23 are rejected under 35 U.S.C. 101 because the claimed invention is 
directed to non-statutory subject matter. . 

a. Referring to Claim 1: 

Claim 1 recites "an authentication system, comprising: a number of 
authentication agents, each of the authentication agents authenticating 
at least one user parameter by performing at least one authentication 
task; and an authentication manager that requests each of the 
authentication agents to authenticate an unauthenticated user 
parameter". In Claim 1, the system is determined to be a software 
system according to application's own disclosure in Fig. 2 (the 
authentication system is stored in the memory) and in lines 2-3 of [0057] 
(the authentication system 143 of the present invention is embodied in 
software or code). The descriptions or expressions of the programs are 
not physical "things." They are neither computer components nor 
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statutory processes, as they are not "acts" being performed. Such 
claimed computer programs do not define any structural and functional 
Interrelationships between the computer program and other claimed 
elements of a computer which permit the computer program's 
functionality to be realized. Therefore, Claim 1 is rejected under 35 
U.S.C. 101 for reciting non-statutory matter relating to software program. 
In addition, Claim 1 is directed merely to an abstract idea regarding to an 
authentication matter that is not required to be tied to a technological art, 
environment or machine which would result in a practical application 
producing a concrete, useful, and tangible result to fonm the basis of 
statutory subject matter under 35 U.S.C. 101. Therefore, Claim 1 is also 
rejected under 36 U.S.C. 101 for reciting non-statutory matter relating to 
abstract idea without the need of technological art. 

b. Referring to Claims 2-8: 

As per Claims 2-8, they inherit the deficiency as in Claim 1 . In addition, 
Claims 2-8 are directed merely to an abstract idea that is not required to 
be tied to a technological art, environment or machine which would result 
in a practical application producing a concrete, useful, and tangible result 
to form the basis of statutory subject matter under 35 U.S.C. 101. 
Therefore, Claims 2-8 are rejected under 35 U.S.C. 101 for reciting non- 
statutory matter. 

c. Referring to Claim 9: 
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Claim 9 recites "an authentication method, comprising: providing for a 
number of authentication agents, each of the authentication agents 
being configured to perform at least one authentication task; requesting 
each of the authentication agents to authenticate an unauthenticated 
user parameter; and obtaining a response from each of the 
authentication agents indicating whether the unauthenticated user 
parameter has been authenticated". Claim 9 (the actions of providing, 
requesting, and obtaining recited in the claim) is directed merely to an 
abstract idea that is not required to be tied to a technological art, 
environment or machine which would result in a practical application 
producing a concrete, useful, and tangible result to form the basis of 
statutory subject matter under 35 U.S.C. 101. Therefore, Claim 9 is 
rejected under 35 U.S.C. 101 for reciting non-statutory matter. 
. d. Referring to Claims 10-15: 

As per Claims 10-15, they inherit the deficiency as in Claim 9. In 
addition, Claims 10-15 are directed merely to an abstract idea that is not 
required to be tied to a technological art, environment or machine which 
would result in a practical application producing a concrete, useful, and 
tangible result to form the basis of statutory subject matter under 35 
U.S.C. 101. Therefore, Claims 10-15 are also rejected under 35 U.S.C. 
1 01 for reciting non-statutory matter, 
e. Referring to Claim 16: 
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Claim 16 recites "a computer program embodied on a computer 
readable medium for performing authentication, comprising: code that 
embodies a number of authentication agents, each of the authentication 
agents authenticating at least one user parameter by performing at least 
one authentication task; and code that embodies an authentication 
manager that requests each of the authentication agents to authenticate 
an unauthenticated user parameter". In Claim 16, the descriptions or 
expressions of the programs are not physical "things." They are neither 
computer components nor statutory processes, as they are not "acts" 
being performed. Such claimed computer programs do not define any 
structural and functional interrelationships between the computer 
program and other claimed elements of a computer which permit the 
computer program's functionality to be realized. Therefore, Claim 16 is 
rejected under 35 U.S.C. 101 for reciting non-statutory matter relating to 
a computer program. In addition, Claim 16 recites another non-statutory 
matter based on the applicant's disclosure in the specification in lines 
13-16 of [0060] (The computer readable medium can comprise any one 
of many physical media such as, for example, electronic, magnetic, 
optical, electromagnetic, infrared, or semiconductor media). The 
aforementioned electronic, magnetic, optical, electromagnetic, and 
infrared media are intangible media, and thus, rejected under 35 U.S.C. 
101 for reciting non-statutory matter relating to intangible media. 
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f. Referring to Claims 17-23: 



As per Claims 17-23, it inherits the deficiency as in Claim 16. In 
addition. Claims 17-23 are directed merely to an abstract idea that is not 
required to be tied to a technological art, environment or machine which 
would result in a practical application producing a concrete, useful, and 
tangible result to form the basis of statutory subject matter under 35 



U.S.C. 101. Therefore, Claims 17-23y^ected under 35 U.S.C. 101 for 
reciting non-statutory matter. 



4. Claims have been afforded their broadest reasonable interpretation. Applicant's 
language directed to authentication manager is interpreted as equivalent to the 
authentication engine and authentication host in the authentication server. The 
claim language, "discover", is interpreted as equivalent to the act included in 
establishing link(s) between two or more objects for the communication or 
distribution of relevant information. 



The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that 
form the basis for the rejections under this section made in this Office action: 

A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by 
another filed in the United States before the invention by the applicant for patent or (2) a patent 
granted on an application for patent by another filed in the United States before the invention by the 




Claim Interpretation 



Claim Rejections - 35 USC § 102 
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applicant for patent, except that an international application filed under the treaty defined in section 
351(a) shall have the effects for purposes of this subsection of an application filed in the United States 
only If the international application designated the United States and was published under Article 21(2) 
of such treaty in the English language. 

5. Claims 1 , 4, 6-7, 9, 1 1 , 13-14, 16, 19, and 21-22 are rejected under 35 
U.S.C. 102(e) as being anticipated by Pang et al. (U.S. Patent 6,446,204). 
a. Referring to Claim 1: 

As per Claim 1, Pang et al. disclose an authentication system, 
comprising: 

a number of authentication agents [i-e., a plurality of authentication 
service providers (simply referred to as providers) (lines 1-2, Col. 
19)], each of the authentication agents authenticating at least one user 
parameter by performing at least one authentication task [i.e., Each 
provider provides a specific authentication function to restrict 
access to a particular cartridge. For example, a BASIC provider 
may be associated with the authentication host an used to restrict 
cartridge access to only those browser request that are associated 
with a particular username and password pair (lines 26-31, Col. 20); 
where username and password are the authentication parameters]; 
and 

an authentication manager [i.e., Authentication engine 602, an 
authentication host 604 (line 67, Col. 18 and line 1, Col. 19)] that 
requests each of the authentication agents to authenticate an 
unauthenticated user parameter [i.e., Upon receiving an 
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authentication request, the authentication engine 602 parses the 
authentication request into one of more provider requests. The 
authentication engine 602 then sends the provider request to the 
authentication host 604 via the object request brolcer 282 for 
distribution to the appropriate provider. Upon receiving the 
provider request from the authentication engine 602, the 
authentication host 604 forwards each provider request to the 
appropriate provider (lines 54-62, Col. 21)]. 
b. Referring to Claim 4: 

As per Claim 4, Pang et al. disclose the authentication system of claim 1, 
further comprising a parameter type associated with each of the 
authentication agents, wherein each of the authentication agents 
authenticates the unauthenticated user parameter if the unauthenticated 
user parameter is of the parameter type associated with the respective 
authentication agent [i.e., a BASIC provider may be associated with 
the authentication host and used to restrict cartridge access to 
only those browser request that are associated with a particular 
usemame and password pair. Thus, when the BASIC provider 
receives a provider request from the authentication host, the BASIC 
provider searches a predefined usemame/password access list to 
determine if access should be provided (lines 28-35, Col. 20). The 
IP address provider can be used to restrict cartridge access to only 
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those browser requests that are associated with a particular IP 
address. Thus, when the IP address provider receives a provider 
request from the authentication host, the IP address provider 
searches a predefined IP access list to determine if access should 
be provided (lines 45-50, Col. 20). Similar results are also for other 
types of providers, such as DOMAIN name provider in lines 60-66, 
Col. 20 and DATABASE provider in lines 9-15, Col. 21]. 
c. Referring to Claim 6: 

As per Claim 6, the rejection of Claim 1 is Incorporated. In addition, 
Pang et al. disclose the authentication system of claim 1, wherein: each 
of the authentication agents transmits an invalid response to the 
authentication manager upon a failure to authenticate the 
unauthenticated user parameter; and each of the authentication agents 
transmits a valid response to the authentication manager if the 
unauthenticated user parameter is successfully authenticated [i.e.. If the 
BASIC provider finds a username/password match, the BASIC 
provider sends a message to the authentication host indicating that 
access should be allowed based on the supplied usemame and 
password pair. However, if the BASIC provider does not find a 
match, the BASIC provider sends a message to the authentication 
host indicating that access should not be allowed based on the 
username/password pair (lines 35-42, Col. 20). Similar results are 
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also for other types of providers, such as DOMAIN name provider 
in lines 66-67, Col. 20 and lines 1-6, Col. 21, and DATABASE 
provider in lines 15-23, Col. 21]. 

d. Referring to Claim 7: 

As per Claim 7, Pang et al. disclose the authentication system of claim 1. 
Pant et al. do not expressly disclose wherein the authentication manager 
discovers the authentication agents [i.e., Providers are impliemented 
as dynamically linked libraries (DLLs). As such, the providers are 
loaded into and execute within the same address space as the 
authentication hosts to which they belong (lines 1-4, Col. 20). The 
authentication engine 602 then sens the provider requests to the 
authentication host 604 via the object request broker 282 for 
distribution to the appropriate provider (lines 56-59, Col. 21)]. 

e. Referring to Claim 9: 

As per Claim 9, Pang et al. disclose an authentication method, 
comprising: providing for a number of authentication agents, each of the 
authentication agents being configured to perform at least one 
authentication task and requesting each of the authentication agents to 
authenticate an unauthenticated user parameter as in Claim 1. In 
addition Pang et al. disclose obtaining a response from each of the 
authentication agents indicating whether the unauthenticated user 
parameter has been authenticated p.e.. The provider then sends a 
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response message back up to the authentication engine 602 via the 
authentication host 604 and the object request broker -282 that 
indicates whether access should be allowed based on the 
information contained in the provider request (lines 65-67, Col. 19 
and lines 1-2, Col. 22)]. 

f. Referring to Claim 1 1: 

As per Claim 11, the rejection of Claim 9 is incorporated. In addition, 
Claim 11 encompasses limitations that are similar to those of Claim 4. 
Thus, it is rejected with the same rationale applied against Claim 4 
above. 

g. Referring to Claim 13: 

As per Claim 13, the rejection of Claim 9 is incorporated. In addition, 
Claim 13 encompasses limitations that are similar to those of Claim 6. 
Thus, it is rejected with the same rationale applied against Claim 6 
above. 

h. Referring to Claim 14: 

As per Claim 14, the rejection of Claim 11 is incorporated. In addition, 
Claim 14 encompasses limitations that are similar to those ofClaim 7. 
Thus, it is rejected with the same rationale applied against Claim 7 
above. 

i. Referring to Claim 16: 
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As per Claim 16, it encompasses limitations that are similar to those of 
Claim 1. Thus, it is rejected with the same rationale applied against 
Claim 1 above. In addition. Pang et al. disclose a computer program 
embodied on a computer readable medium for performing authentication 
[i.e., The term "computer-readable medium" as used herein refers 
to any medium that participates in providing instructions to 
processor 104 for execution (lines 58-60, Col. 4)]. 
j. Referring to Claim 19: 

As per Claim 19, the rejection of Claim 16 is incorporated. In addition, 
Claim 16 is a computer-readable medium claim corresponding to the 
system claim 4. Thus, it is rejected with the same rationale applied 
against Claim 4 above. 
. k. Referring to Claim 21: 

As per Claim 21, the rejection of Claim 16 is incorporated. In addition, 
Claim 21 is a computer-readable medium claim corresponding to the 
. system claim 6. Thus, it is rejected with the same rationale applied 
. against Claim 6 above. 
I. Referring to Claim 22: 

As per Claim 22, the rejection of Claim 16 is incorporated. In addition. 
Claim 22 is a computer-readable medium claim corresponding to the 
system claim 7. Thus, it is rejected with the same rationale applied 
against Claim 7 above. 
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Claim Rejections - 35 USC § 103 

The following Is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set 
forth in section 1 02 of this title, if the differences between the subject matter sought to be patented and 
the prior art are such that the subject matter as a whole would have been obvious at the time the 
invention was made to a person having ordinary skill in the art to which said subject matter pertains. 
Patentability shall not be negatived by the manner In which the invention was made. 

6. Claims 2, 8, 15, 17, and 23 are rejected under 35 U.S.C. 103(a) as being 
unpatentable over Pang et al. (U.S. Patent 6,446,204). 
a. Referring to Claim 2: 

As per Claim 2, Pang et al. disclose the authentication system of claim 1 . 
In addition. Pang et al. disclose each response indicating whether the 
unauthenticated user parameter has been authenticated [i.e., The 
provider then sends a response message back up to the 
authentication engine 602 via the authentication host 604 and the 
object request broker 282. The response message indicates 
whether access should be authorized based on the information 
contained in that particular provider request (lines 17-22, Col. 19)]. 
Pang et al. do not expressly disclose wherein the authentication 
manager waits for a response from each of the authentication agents. 
However, Pang et al. disclose the request may be removed from the 
waiting list and the message may be sent to the browser to indicate that 
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the request cannot be processed if the request stayed on the waiting list 
for a predetermined amount of time [i.e., If the revised browser 
request remains on the waiting list for more than a predetermined 
amount of time, listener 210 may remove the request from the 
waiting list and send a message to the browser 202 to indicate that 
the request could not be processed (lines 60-64, Col. 16)]. 
Therefore, it would have been obvious to one of ordinary sidll in the art at 
the time of invention was made to modify Pang et al. to have the 
predetermined-waiting-time feature incorporated into the authentication 
process since one would have been motivated to increase the 
efficiency of the application server (line 9, Col. 13) by imposing an 
additional restriction on the authentication response waiting time, 
b. Referring to Claim 8: 

As per Claim 8, Pang et al. disclose the authentication system of claim 7. 
Pang et al. do not expressly disclose wherein the authentication 
manager generates a lookup table listing each of the authentication 
agents that are discovered. However, Pang et al. disclose a function 
pointer table and a property table maintained in each provider [i.e. Each 
provider contains a table of function pointers and a properties list. 
The function pointer table provides pointers to particular provider 
functions that may be accessed by the authentication host 604. The 
property list describes the type of authentication information (such 
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as the identity of the user initiating the request for a cartridge) that 
are required for accessing the particular provider. According to 
one embodiment, the property tables include the name of the 
provider, the location where its DLL is stored on disk and an entry 
point address (lines 6-15, Col. 20)]. Therefore, it would have been 
obvious to one of ordinary skill in the art at the time of invention was 
made to modify Pang et al. to have the table generated and also 
maintained by the authentication host since one would have been 
motivated to conveniently having an authentication host can call the 
entry point to obtain a list of function pointers that can be used in 
authenticating a particular provider request (lines 15-17, Col. 20). 

c. Referring to Claim 15: 

As per Claim 15, the rejection of Claim 14 is incorporated. In addition, 
Claim 15 encompasses limitations that are similar to those of Claim 8. 
Thus, it is rejected with the same rationale applied against Claim 8 
above. 

d. Referhna to Claim 17: 

As per Claim 17, the rejection of Claim 16 is incorporated. In addition, 
Claim 17 is a computerrreadable medium claim corresponding to the 
system claim 2. Thus, it is rejected with the same rationale applied 
against Claim 2 above. 

e. Referring to Claim 23: 
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As per Claim 23, the rejection of Claim 22 is incorporated, in addition, 
Claim 23 is a computer-readable medium claim corresponding to the 
system claim 8. Thus, it is rejected with the same rationale applied 
against Claim 8 above. 

7. Claims 3, 10, and 18 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Pang et al. (U.S. Patent 6,446,204) as applied to claims 1 , 9, and 16 above, 
and further in view of Paknad (U.S. Pub. 2002/0069247). 
a. Referring to Claim 3: 

As per Claim 3, Pang et al. disclose the authentication system of claim 1 . 
Pang et al. do not expressly disclose an external authentication service; 
and wherein at least one of the authentication agents calls upon the 
external authentication service to authenticate the unauthenticated user 
parameter. However, Paknad et al. disclose that external service can be 
called upon for authentication of the user [i.e., In an embodiment of the 
invention, outside authentication services 410, such as LDAP, NT, 
and NIS, may be used to authenticate the user (line 21-24 in 
[0124])]. Pang et al. and Paknad et al. are analogous art because they 
are from similar technology relating to the computer information for user 
identification. It would have been obvious to one of ordinary skill in the 
art at the time of invention was made to modify Pang et al. with Paknad 
et al. since one would have been motivated to have a system for 
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creating and managing an electronic network of collaboration sites 
(lines 2-3 in [0005]). Therefore, it would have been obvious to combine 
Pang et al. and Paknad et al. to obtain the invention as specified in claim 
3. 

b. Referring to Claim 10: 

As per Claim 10, the rejection of Claim 9 is incorporated. In addition, 
Claim 10 encompasses limitations that are similar to those of Claim 3. 
Thus, it is rejected with the same rationale applied against Claim 3 
above. 

c. Referring to Claim 18: 

As per Claim 18, the rejection of Claim 16 is incorporated. In addition, 
Claim 18 Is a computer-readable medium claim corresponding to the 
system claim 3. Thus, it is rejected with the same rationale applied 
against Claim 3 above. 

8. Claims 5, 12, and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable 
over Pang et al. (U.S. Patent 6,446,204) as applied to claims 4, 11, and 19 
above, and further in view of Robbins et al. (U.S. Pub. 2003/015,905,5). 
a. Referring to Claim 5: 

As per Claim 5, Pang et al. disclose the authentication system of claim 4. 
Pang et al. further disclose wherein: each of the authentication agents 
transmits an invalid response to the authentication manager upon a 
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failure to authenticate the unauthenticated user parameter [i.e., 
However, if the BASIC provider does not find a match, the BASIC 
provider sends a message to the authentication host indicating that 
access should not be allowed based on the username/password 
pair (lines 35-39, Col. 20). Similar results are also for other types of 
providers, such as DOMAIN name provider in lines 66-67, Col. 20 
and lines 1-6, Col. 21, and DATABASE provider in lines 15-23, Col. 
21]; . 

each of the authentication agents transmits a valid response to the 
authentication manager upon a successful authentication of the 
unauthenticated user parameter [i.e.. If the BASIC provider finds a 
username/password match, the BASIC provider sends a message 
to the authentication host indicating that access should be allowed 
based on the supplied usemame and password pair (lines 39-42, 
Col. 20). Similar results are also for other types of providers, such 
as DOMAIN name provider in lines 66-67, Col. 20 and lines 1-6, Col. 
21, and DATABASE provider in lines 15-23, Col. 21]. 
Pang et al. do not expressly disclose each of the authentication agents 
transmits a valid response to the authentication manager if the 
unauthenticated user parameter is of a parameter type that is different 
than the parameter type associated with the respective authentication 
agent. However, Robbins et al. disclose an error message is returned to 
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indicate that validation is not possible [i.e., If the verification agent is 
unable to verify itself, an error message is returned in block P435. 
If the verification agent is able to verify itself, the process 
continues to the next step in block P440 (lines in [0032])]. Pang et 
al. and Robbins et al. are analogous art because they are from similar 
technology relating to information verification system. It would have 
been obvious to one of ordinary skill in the art at the time of invention 
was made to modify Pang et al. with Robbins et al. to have agents 
returning a valid error message indicating the request is not of the right 
type since one would have been motivated to improve management of 
larger applications where multiple object modules and components 
have to be signed and verified (lines 6-8, in [0038]). Therefore, it 
would have been obvious to combine Pang et al. and Robbins et al. to 
obtain the invention as specified in claim 5. 

b. Referring to Claim 12: 

As per Claim 12, the rejection of Claim 11 is incorporated. In addition, 
Claim 12 encompasses limitations that are similar to those of Claim 5. 
Thus, it is rejected with the same rationale applied against Claim 5 
above. 

c. Referring to Claim 20: 

As per -Claim 20, the rejection of Claim 19 is incorporated. In addition. 
Claim 20 is a computer-readable medium claim corresponding to the 
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system claim 5. Tlius, it is rejected with the same rationale applied 
against Claim 5 above. 

Conclusion 

9. The prior art made of record and not relied upon is considered pertinent to 
applicant's disclosure. 

a. Hillier et al. (U.S. Patent 6,055,636) disclose a method and apparatus for 
centralizing the processing of key and certificate life-cycle management. 
The apparatus contains a security activation module, a security parameter ' 
module and a security service provider module, which contains a plurality 
of secure processing modules. 

b. Ohashi et al. (U.S. Patent 5,761,309) disclose an authentication system, 
which has a single master authentication center arranged in the network, 
the master authentication center sharing with the user a user secret key, 
and a plurality of slave authentication centers sharing with the master 
authentication center respective secret keys different from the user secret 
key. 

c. Sinn (U.S. Pub. 2002/016,604,9) disclose an identity system for retrieving 
real time status information for the system's certificates and stores a 
record of the status. The identity system includes an identity server, which 
manages many identity profiles. Each of the identity profiles handles 
different functions. 
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10. Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Yin-Chen Shaw whose telephone number is 571- 
272-8593. The examiner can normally be reached on 8:15 to 4:15 M-F. 
If attempts to reach the examiner by telephone are unsuccessful, the examiner" 
supervisor, Kim Yen Vu can be reached on 571-272-3869. The fax phone 
number for the organization where this application or proceeding is assigned is 
703-872-9306. 

Infonnation regarding the status of an application may be obtained from the 
Patent Application Information Retrieval (PAIR) system. Status information for 
published applications may be obtained from either Private PAIR or Public PAIR. 
Status information for unpublished applications is available through Private PAIR 
only. For more information about the PAIR system, see http://pair- 
direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll- 
free). 



YCS 



Jun. 29. 2005 




